Annex II User Information Requirements

Annex II of the Cyber Resilience Act sets out the information that manufacturers must provide with their products. Unlike Annex I (which specifies technical security requirements) or Annex VII (which specifies documentation for regulators), Annex II is consumer-facing. Required information includes: the name, registered trade name or trademark, and postal address of the manufacturer; the product's unique product identifier (typically a model number or version); any intended purpose and conditions of use that affect security; known vulnerabilities at the time of placing on the market; the expected support period; the address where security-related information can be found; instructions for secure configuration; and information on how to report vulnerabilities. This information must be clear, understandable, and accessible.

One of the most commercially significant Annex II requirements is the obligation to disclose the product's support period - the duration for which the manufacturer will provide security updates. This must be stated clearly to users at or before the point of sale. The CRA does not prescribe a minimum support period but requires that manufacturers provide one commensurate with the product's expected use. Products sold with short or no stated support periods face competitive disadvantage as users increasingly demand long-term security commitments. The disclosed support period creates a legal obligation: once stated, manufacturers must actually provide security updates throughout that period or face non-compliance. For consumer IoT devices, the declared period should reflect how long the device is expected to be in use. Commission guidance C(2026) 5252 point 126 states that the five-year figure is a floor rather than a default.

Annex II requires manufacturers to provide users with a contact point for security-related issues, including vulnerability reporting. This operationalises the broader CVD requirement of Article 13(6) by making the reporting channel publicly visible and easily discoverable at the product level - not just buried in a policy document. In practice, manufacturers typically fulfil this by: including a security contact email or URL in the product's user documentation; publishing a security.txt file at the product's associated website; and referencing the vulnerability reporting channel in the product's settings interface where feasible. The contact details must remain valid and monitored throughout the entire support period.

Manufacturers should integrate Annex II disclosure requirements into their standard product documentation workflow. Key implementation steps:

• Pre-launch: Ensure product documentation, packaging, and the product's associated web presence include all required Annex II information before the product is placed on the market.
• Version control: The unique product identifier must allow users and regulators to identify the specific version they are assessing. This is critical for vulnerability correlation.
• Support period commitment: Define and document the support period during product planning, not as an afterthought. It affects resource planning, pricing, and legal exposure.
• Security page maintenance: Maintain a dedicated security page at a stable URL where vulnerability reporting instructions, security advisories, and update information are published throughout the product lifecycle.